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FEDERAL BUREAU OF INVESTIGATION 



Date of transcription 04/27/2011 

SA Cauthen appeared at 3381 Shadow Tree Dr., Apartment 
327, Sacramento, CA on 04/27/2011. SA Cauthen noted that this 
apartment, which was believed to be occupied by Matthew Keys, 
appeared to be empty. SA Cauthen could observe through the front 
door window that there was no furniture in the apratment. The 
window blinds were open. 

The apartment complex managers would not provide any 
information about Matthew Keys or the occupants of Apartment 327 
without court order. The managers provided the name of Cody 
Marriott, 3334 Smoketree Dr., Sacramento, CA telephone 916-927-2200 
as a person who would be in a position to receive a subpoena for 
information on Apartment 327. 

Thereafter SA Cauthen telephoned 916-572-5895 and asked 
to speak with Matthew Keys. Keyes identified himself immediately 
and SA Cauthen then identified himself and advised that he was 
working on a criminal computer intrusion case involving the hacking 
group "Anonymous". 

Keys stated that he had information pertaining to this 
group and that he was willing to provide this information but that 
it was going to be published anyway as he was a journalist working 
with a foreign news organization on a story involving Anonymous. 
Keys desired to fax or e-mail the information he had. 

SA Cauthen replied that he did not desire to receive 
information this way and that he suspected that Keys 1 computer had 
been compromised along with his social media accounts by the 
hacking group. SA Cauthen explained that he was concerned that if 
his name or the FBI's interest in the group were to be found on 
Keys computer and/or disseminated through a social networking sites 
than the subjects of the investigation could be alerted and in a 
position to destroy evidence. SA Cauthen advised that he preferred 
a face-to-face meeting. 

After discussion, it was agreed that the first available 
time both parties could be available to meet in Sacramento was 
during the week of 05/10/2011. Keys no longer resided in 
Sacramento and was currently traveling. SA Cauthen advised that he 
would contact Keys during that week to schedule a time and place. 
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SA Cauthen requested that Keys bring his computer to the 
meeting and, in particular, any logs or communications he had with 
members of the group Anonymous. 

Keys replied that he was uncertain about what information 
he would provide insomuch he was a journalist. SA Cauthen then 
replied that a week or more should provided him ample time to 
consult with appropriate legal counsel about what information he 
would be required, or willing, to provide. 




ANDREWS, GABRIEL F. (LA) (FBI) 



From: 

Sent: 

To: 

Cc: 

Subject: 



CAUTHEN, JOHN M. (SC) (FBI) 

Friday, January 13, 2012 9:13 AM 
SPRINGER, SCOTT A., (SC)(FBI) 

DRONE, WESLEY S (SC)(FBI); ANDREWS, GABRIEL F, (LA) (FBI) 
Summary of Matthew Keys Investigaiton 



Classification: UNCLASSIFIED 



ASSA Springer, Per your request, here is a summary of the Keys investigation and the plan with regard to 
executing a search warrant and interrogation. 



FOX40 News is a television station in Sacramento, CA. The station is 
owned by Tribune Media Company in Chicago, IL which also owns LA Times in 
Los Angeles, CA. 

All Tribune Media Company entities, including FOX40 and LA Times, use a 
computer to manage email and online content. The computer is located in 
Los Angeles, CA. 

On October 28, 2010, Matthew Keys an employee of FOX40 News, was fired. 
Our investigation determined that after he was fired, he hijacked the 
FOX40 News Facebook and Twitter accounts. He prevented FOX40 from 
accessing these accounts and sent communications from the accounts to the 
public which damaged the reputation of FOX40 News. He also deleted 
thousands of followers from the accounts. 

Investigation also determined that in December 2010, Keys accessed, 
without authorization, the computer in Los Angeles and stole the FOX40 
News customer e-mail list. He sent harassing emails to FOX40 News 
employees and customers. On December 8, 2010, Keys contacted the hacking 
group called "Anonymous." He gave some Anonymous group members the 
password to the computer in Los Angeles. The hackers used this access to 
access the website for the LA Times and deface the website. 

The damages incurred by The Tribune Media Company due to the website 
defacement exceeded $1.5 million. 

In April 2011, Sacramento FBI contacted Keys who was still believed to be 
unemployed. Keys advised that he had records relating to his interaction 
with the group Anonymous . He refused to turn them over citing his 
journalistic privilege. (It appears he had found a job at a television 
station in San Francisco) 

In June 2011, Sacramento recommended that the case be transferred to Los 
Angeles. (At the time, there was not sufficient evidence to support that 
Keys was involved in the above intrusions. Instead, there was only 

l 



evidence about the subject to whom Keys gave the password. So, Keys was 
removed from the case and the new subject. Unsub aka Sharpie, was added.) 

In September 2011, Los Angeles opened the case on Unsub aka Sharpie. The 
old case Sacramento was transferred to Los Angeles . 

In December 2011, Sacramento, while working on the HBGary computer 
intrusion case, located the evidence showing Keys had turned the password 
to the Los Angeles computer over to Unsub aka Sharpie, and others. 

In January 2012, Sacramento opened a new case on Matthew Keys for 
trafficking in passwords. Sacramento and Los Angeles agreed to work the 
matter jointly. The case will be prosecuted in Sacramento against Keys. 
Los Angeles will prosecute the case against Unsub aka Sharpie, and others. 

Keys has recently been hired by Reuters in New York City. He currently 
resides in Vacaville, CA. He begins work in New York on 1/19/2012. He is 
expected to depart Sacramento on 1/17/2012. 

Sacramento and Los Angeles have probable cause that evidence is on Keys ' 
computer containing logs regarding the trafficking in passwords and other 
crimes. A search warrant affidavit to seize his computer media has been 
prepared. 

When serving the search warrant, Sacramento and Los Angeles desire to 
interrogate Keys about his involvement with Anonymous members and his 
involvement in the disruption of business at FOX40 News. Interrogation of 
a journalist requires Attorney General consent. The AUSA in Sacramento is 
seeking to obtain this consent. Once obtained, the search warrant for 
whatever district Keys is in will be obtained. The search/interrogation 
will take place in that district. It will probably be in New York City. 

Sacramento Case Agent: Wesley S. Drone 

Los Angeles Case Agent: Garbriel F. Andrews 

AUSA in Sacramento prosecuting Keys: Matthew Segal 

AUSA in New York: Thomas Brown 

AUSA in Los Angeles prosecuting "Sharpie" : 

Los Angeles Case: 288A-LA-258500 Pending 

Old Sacramento Case on Sharpie/Keys: 288A-SC-44639 Closed 
New Sacramento Case on Keys: 288A-SC-New 



SA John M. Cauthen 
Office: 916-874-6492 
Cell: 916-416-6714 
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ANDREWS, GABRIEL F. (LA) (FBI) 

From: CAUTHEN, JOHN M. (SC) (FBI) 

Sent: Wednesday, January 04, 2012 3:53 PM 

To: ANDREWS, GABRIEL F. (LA) (FBI) 

Subject: RE: Good afternoon 

Follow Up Flag: Follow up 

Flag Status: Completed 



Classification: UNCLASSIFIED 



Gabriel, 

Everything is in the case file. I am pretty sure all the emails are on a disk in a 1A envelope. (At least I sure hope that's 
the case!) I might have some backups of the threatening emails to Fox40 on our CART Storage Area Network drive. But 
check the lA's for CD's. 

On a related note, I got a call from our CYBER AUSA, his name is Matt Segal. (We only have one in Sacramento!) I 
briefed him on the status and what we discussed. He was the original AUSA on the case. (He is also the same AUSA who 
is handling the HB Gary case which has all the IRC logs including the one where Kayla tells Laurelai that AESCracked is 
Matt Keys and Matt Keys gave them all the passwords. ) 

In any case AUSA Segal is quite upset with me for sending the case to LA. He really wants to indict Keys. (Even though at 
the time, I was unaware that Keys had provided the passwords to Anonymous). He wants to call your AUSA and see if he 
can charge Keys and let you guys charge Kayla/Sharpie et al. 

It seems that all the AUSA's involved in Anonymous are going to have a conference call tomorrow to discuss. He wants 
to bring this issue up during that call. 

Is it your thought that your case has now shifted to Matt Keys as your primary target? Or, do you still plan on going after 
Kayla/Sharpie? 

In any case, can the AUSA in Sacramento contact your AUSA to discuss? Or your AUSA can call Matt directly. Matt's 
number is 916-554-2708. 

Feel free to call me if you like. I am trying to keep our AUSA happy, but understand that we have already sent the case 
to you and therefore not in a position to make any demands. 

Regards 

SAJohn M. Cauthen 
Office: 916-874-6492 
Cell: 916-416-6714 



From: ANDREWS, GABRIEL F. (LA) (FBI) 
Sent: Wednesday, January 04, 2012 2:42 PM 



19 



To: CAUTHEN, JOHN M. (SC) (FBI) 
Subject: Good afternoon 



Classification: UNCLASSIFIED 



Hi John, 

I've been reviewing the Tribune Media case file today, and wondered if you wouldn't mind forwarding me some of the 
victim emails you'd mentioned in your summary EC's. 

Namely: 

• The various emails obtained from Mercer (threatening / Keys / etc) 

• Armando Caro, Tribune Media employee, Managing 
Director, Technology Architect, Tribune Technology, 435 N. 

Michigan Ave Chicago, IL 60611 (312) 222-2708 
armandoCarotaTribune.com sent writer an email detailing the 
investigation performed by their organization regarding a 
computer intrusion performed against the Los Angeles Times on 
12/14/2010. The computer intrusion resulted in a webpage 
defacement wherein the defacer used the tag, "chippyl337." 

As we discussed before, I'm hoping to have a sit-down with my AUSA soon to discuss charging Keys. I'm happy to keep 
you in the loop. 

Respectfully yours, 

-Gabriel 



Classification: UNCLASSIFIED 



Classification: UNCLASSIFIED 



20 




( ^ivev. j - o-iwj 



UNCLAS S I FI ED / / FOUO 

FEDERAL BUREAU OF INVESTIGATION 



*J [pimftt; Havfr - 
CelWiNilHsI 



Electronic Communioalion 



Title: (U) To document Liaison Contact with the Date: 01/16/2013 

United Kingdom's Metropolitan Police 
Service 

To: Gabriel F. Andrews 

Jensen D. Penalosa 
WF-CY4 (OST) 

From: WASHINGTON FIELD 

WF-ID03 

Contact: JON-TODD A. BAKER, 703-686-6770 



Approved By: A/SSA Hadley Etienne 

SIA DELGRECO TIFFANY MARIE 

Drafted By: JON-TODD A. BAKER 

BORSUK DANIEL G 

Case ID #: 288A-WF-242710 (U) ANONYMOUS HACTIVIST INDIVIDUAL IOWA 

RIAA-VICTIM; COMPUTER INTRUSION-OTHER; 
288A-WF-C241640-C (U) LIAISON 

288A-WF-C241640-J (U) INTELLIGENCE 

Synopsis: (U//FOUO) To document liaison contact with the UK's 

Metropolitan Police Service Police Central e-Crime Unit (PCeU) 
concerning Anonymous hackitivst activity and the moniker "Sharpie" 

Full Investigation Initiated: 02/23/2012 

Details : 

(U//FOUO)On 16 January 2013 FBI Intelligence Analyst Jon-Todd Baker and 
Special Agent Daniel Borsuk telephonically contacted Detective Sergeant 
Andy Bloomfield of the United Kingdom's Metropolitan Police Service, 
Police Central e-Crime Unit (PCeU) regarding the ANONYMOUS hacktivist 
"SHARPIE". During that conversation detective Bloomfield provided the 
following information about the user of the moniker SHARPIE. 
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Title: (U) To document Liaison Contact with the United Kingdom's 

Metropolitan Police Service 
Re: 288A-WF-242710, 01/16/2013 

True name: David George Sharp 
DOB: 27 December 1979 

Country of residence: Scotland (United Kingdom) 

Address: 8 Morrison Drive, Postal code FK70HZ, Sterling, Scotland 

(U//LES) Detective Bloomfield explained that SHARPIE was among the UK 
based Anonymous members that PCeU investigated under their Operations 
named "Ucon" and "Westfailian" . PCeU passed the information regarding 
SHARPIE'S identity and involvement in criminal hacktivist activities to 
the Scottish Crime and Drug Enforcement Agency (SCDEA) . Detective 
Bloomfield explained that he doubts that the SCDEA conducted any law 
enforcement action based on that information because no report was ever 
received from SCDEA in response to the passed information; which is a 
standard practice adhered to when the SCDEA acts on information 
provided to them by PCeU. Detective Bloomfield said he would verify 
with the SCDEA what if any law enforcement actions were taken against 
SHARPIE. 

(U//FOUO) IA Baker inquired of Detective Bloomfield regarding a 
previously made request for any Internet Relay Chat (IRC) logs seized 
or otherwise lawfully obtained by PCeU that pertain to the following 
criteria. 

• Mention ANONYMOUS' "OPERATION PAYBACK" campaign 

• Cover the timeframe from 16 September 2010 to 27 January 2011 

• Mention or include the moniker ANONYJOSH 

• Mention or include the moniker TICKL 

• Mention or include the moniker IOWA 

• Mention or include the moniker OWEN 

• Mention or include the moniker INTERNETS 

(U/ /FOUO) Detective Bloomfield stated that he would follow-up with 
Stewart Garrick who runs PCeU's database housing data obtained under 
Operations Ucon and Westfailian to get the chats passed to FBI 
Washington Field. IA Baker requested that any chats mentioning or 

UNCLAS S I FI ED / / FOUO 
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Title: (U) To document Liaison Contact with the United Kingdom's 

Metropolitan Police Service 
Re: 288A-WF-242710, 01/16/2013 

containing the moniker SHARPIE be added to the aforementioned request. 
In subsequent email conversations it was determined that the chats will 
be passed initially for intelligence purposes only and any chats 
determined to have evidentiary value to the captioned investigation 
will be requested via MLAT. 



♦ ♦ 
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FEDERAL BUREAU OF INVESTIGATION 



Precedence: ROUTINE Date: 6/6/2011 

To: Los Angeles Attn: CY-3 SSASmollanoff 

Sacramento Attn: Sacramento ELSUR 

Attn:CY-1 SST Linda Frazier 



From: Sacramento 

CY-1 

Contact: SA John M. Cauthen 

Approved By: Osborne Tom F 

Drafted By: Cauthen John M:jmc 0606jmc01.ec 

Case ID #: 288A-SC-44639 (Pending) 

Title: CHANGED 

Unsub, aka Sharpie; 

Tribune Media -Victim; 

CIP; 

Synopsis: Change case title and transfer investigation to Los Angeles. 



Previous Title: Title marked "Changed" to reflect new subject. Title previously carried as 

"Matthew Keys 
Foxnews.com -Victim; 

CIP;" 



Reference: 288A-SC-44639 Serial 16 

288A-SC-44767 Serial 46 



Reference: Telcall from SA John M. Cauthen, SC, CY-1, to SSA Jason Smolanoff, LA, CY-3 on 6/6/2011. 

Details: Re telcall, this case to be transferred to Los Angeles. The case involves a subject believed to be a 

resident of the United Kingdom who hacked into a computer in Los Angeles and damaged data affecting Tribune Media 
Corporation. Specifically, the subject hacked into a server called P2P and affected databases used by the Los Angeles 
Times and FOXNews40; both entities owned by Tribune Media. 



UNCLASSIFIED 




UNCLASSIFIED 



To: Los Angeles From: Sacramento 

Re: 288A-SC-44G39 



Sacramento opened the investigation, issued four subpoenas the results of which are part of the case file. 

Also, Sacramento conducted one consensual^ recorded telephone call, the results of which were placed into evidence 1D1. 

(A copy was also placed into 1 A evidence.) 

Due to venue issues, the investigation will not be pursued in Sacramento. 

Case Background 

Re serial 16, on about 1 1/7/2010, Unsub, aka Sharpie, logged into IRC chat channels associated with the 
hacking group called "Anonymous.” The IRC channels on which Sharpie participated included #internetfeds and 
#operationpayback. 

Re serial 16, on about 1 1/15/2010, chat on IRC #operationpayback suggested sharpie was UK based. 

Re serial 46, Sharpie was a hacker with the group Anonymous and was involved in "Operation Payback”. 

On about 12/01/2010, the television station KTXL FOX40 located in Sacramento, CA learned it’s e-mail 
contact list had been exfiltrated from the company's server in Los Angeles. The server is called the "P2P Server." The 
exfiltration appeared to have been accomplished via a compromised account on the P2P server. 

After the P2P server was compromised, the manager of the news station began to receive emails from the 
person who purportedly hacked the server. The news station's customers, whose emails were part of the contact list, also 
began to receive e-mails from the person who purportedly hacked the server. 

The majority of the e-mails carried the theme of making disparaging remarks about Fox 40 business 
practices. As determined by header information, the e-mails appeared to come from proxy servers in Europe. 

It appears the hacker also created a fake e-mail account called cybertroll69x@hotmail.com and pretended 
to be Joseph Huerta, a FOX40News employee. As further discussed below, the subject later sent an e-mail using the name 
"Cancer Man" to the FOX40 station manager and included an attachment image called "cyber bullying." The e-mail also 
referenced Matthew Keys who was a former employee of FOX40 News. The email suggested the hacker may have visited 
Huerta's Facebook page.) 

The name "Matthew Keys" also surfaced in an email from the hacker using the moniker "Cancer Man" 
further described below. (By way of background, Matthew Keys was a former FOX40 News employee who was terminated 
in about November 2010.) 

On 12/3/2010, FOX40 News received an email from the hacker with the subject line "Re: Donating." The 
e-mail said "watch yourselves fox 40" and contained a forwarded e-mail which had been sent from the American Cancer 
Society to "Cancer Man." The e-mail appeared response from the American Cancer Society to Cancer Man. Based on the 
response, it appeared the person purporting to be Cancer Man had sent an e-mail to the American Cancer Society from the 
e-mail address cancerman4099@yahoo.co.uk and provided a contact name of Matthew Keys. This e-mail appeared to be in 
the form of a press release and described news coverage of a story by reporter Shawn Bennett. The e-mail referred to the 
station manager's Facebook page - www.Facebook.com/Brandon.Mercer/Posts/173241182694599, which suggested the 
hacker had visited the station manager, Brandon Mercer's, Facebook page. 

On 12/12/2010, Mathews Keys, using e-mail address matthew@sactownmedia.com, sent an unsolicited 
e-mail to FOX40News stating he has infiltrated the hacking group "Anonymous." Keys sent Brandon Mercer, the station 
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To: Los Angeles From: Sacramento 

Re: 288A-SC-44G39 



manager, a list of user names and passwords he claims he "obtained by a high authority within the 'conscious’ hactivist 
organization Anonymous." The list pertained to a hack involving the website "Gawker." Keys also stated he had access to future 
operations, including operations against Pay pal, Amazon, the Los Angeles Times, Fox News, and others. 

On 12/12/2010, Mercer engaged Keys in a consensually recorded telephone conversation. They 
discussed the Gawker hack. Keys said he had entered a chat room with 2,000 plus members. In this chat room. Keys said he 
met someone who invited him into a private chat room populated by 15 highly skilled hackers. Keys discussed the Gawker 
attack, but claimed he did not know how it was done. Keys said he had limited technical knowledge, but did have computer 
records of his interaction with the group over the past week. In communicating with the hackers. Keys has discussed his past 
journalism experience. He believed that the hackers were using him for these skills. It was not clear in these discussions 
whether Keys was acting as a journalist to collect this information. In any case, it was clear he was sharing the information 
he obtained with a journalist from PBS. Keys claimed no knowlege about e-mails being sent to FOX40. 

(FBI Note: Based on the conversation, the appears Keys’ Twitter account may have been compromised by Anonymous 
members.) 



In the conversation, Key stated one of the upcoming targets of Anonymous was the Los Angeles Times. 
Keys had no specifics about what was being planned. 

The Los Angeles Times and Fox40 News are both owned by the same parent company, Tribune Media, 
based in Chicago, IL. They both use the server called P2P, discussed above, which is located in Los Angeles, CA. 

As predicted by Keys, within two days, on 12/14/2010, LA Times server hosting the public facing website 
was compromised. The website was defaced by someone purporting to be Chippy1337. The hack originated from IP 
1 88.1 65.6.1 78 which appeared to be a European proxy server (Ireland). The hack appeared to have been accomplished via a 
compromised account on the P2P server. 

Tribune Media conducted an internal investigation regarding the intrusion performed against the Los 
Angeles Times on 12/14/2010 wherein the hacker used the tag, ”chippy1337." According to Tribune Media management, the 
cost of the intrusion and the resulting time spent resolving it, cost the company over $500,000. (A spreadsheet showing time 
and expenses was prepared by the investigators and is included in the investigative report on DVD in a 1 A envelope) 

Following the website hack, one of the Tribune Media employees accessed an IRC channel called 
#thegibson, hosted at a server called skidsr.us. According to the chats on this channel, a person using the moniker, sharpie, 
claimed to be involved in the LA Times hack and used the tag "chippy1337.". Other persons involved in hack appeared to 
include a person called Nikon. 

Based on the information above, it appears that Keys was involved with the group "Anonymous" and 
members of this group hacked the P2P server on two occasions. The intrusion may have been accomplished by socially 
engineering someone to providing a user passwords. Keys did have access to P2P. His Twitter account may have been 
compromised. Keys therefore may have unwittingly been the vector used to by the hackers to perform the attacks. Or, he may 
have been a willing conspirator. 

The person using the moniker sharpie, appears to be behind the Los Angeles Times hack on 12/14/2010. 

The connection of Sharpie to the hack into the P2P server affecting FOX40News is unclear. The only 
connection appears to be the fact that both hacks apparently involved a compromised user account. 
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To: Los Angeles From: Sacramento 

Re: 288A-SC-44G39 



Writer contacted Matthew Keys 4/27/201 1 and asked him to bring records in his possession relating to the 
hacking group Anonymous. Keys has not responded to this request. 

Writer contacted AUSA Matthew Segal, Eastern District of California on 5/31/2011. Writer expressed die 
opinion that Keys probably did not directly hack into the P2P server although he may facilitated the hack into the P2P server by 
members of Anonymous, albeit unwittingly. AUSA Segal listened to all the information, but was unconvinced that Keys was 
not knowingly involved. AUSA Segal advised that a subpoena, or search warrant, for data in the possession of Keys relating 
to criminal acts by die group Anonymous was feasible, but would require Attorney General concurrence. However, 
insomuch as the P2P server was located in Los Angeles, venue in the Eastern District of California was weak. AUSA Segal 
advised he would decline prosecution based on this fact alone, and recommended transferring the investigation to Los 
Angeles. 



Writer believes the Anonymous member "Sharpie," is in the United Kingdom and is known to police 
officials there for his involvement in the Anonymous group. 

The logical course of action is to request information from investigators in the United Kingdom to see if 
they have information regarding Sharpie. 

The other logical step, would be to retrieve data from Matthew Keys regarding his information re 
Anonymous, - in particular the Anonymous member "Sharpie." To do this, assuming Keys remains uncooperative, would 
require a subpoena or search warrant. Insomuch as Keys considers himself a journalist, and appears uncooperative, this 
approach could require Attorney General concurrence. It is the opinion of Sacramento that Los Angeles has solid jurisdiction 
on the hack into the P2P server and which would permit investigators to compel Keys to provide the information he has about 
Anonymous. 



The final approach would be to seek records from the companies hosting the proxy servers. This seems 
to be the avenue of least potential. 



The only venue in Sacramento lies with the person and computer of Matthew Keys. The following things 
point to Keys criminal culpability: 



a) Keys had recently been terminated from FOX40 News and therefore, he may have borne resentment. 

b) Keys had previously held access to the P2P server and certainly knew how to access it. (However, it not 
known which account on P2P was used to hack the FOX40 News emails, and the account used to hack the Los Angeles Times 
did not appear related with Keys.) 

c) After being let go from FOX40, Keys had accessed and altered other social media websites belonging to 
FOX40 News resulting in loss of data. 

d) Keys' name was referenced in two emails by the person who purported to hack the FOX40 News P2P 



server. 



e) One of the e-mails sent referencing Keys appeared to originate in the Sacramento area. 



However, the writer does not believe that Keys knowingly hacked the P2P server for the following reasons: 



a) While Keys name was mentioned in two emails, it seems illogical that the real hacker would identify 
himself so obviously while going to such lengths to avoid detection through the use of proxy servers. 
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To: Los Angeles From: Sacramento 

Re: 288A-SC-44G39 



b) In the consensualjy recorded telephone call, Keys appears genuinely baffled by allegations he 
perpetrated the intrusion. Keys was otherwise candid about his involvement with the hacking group Anonymous and other 
targets of the group. 

c) Keys, by the account of the FOX40 News station manager, as well as by his statements in the telephone 
call, did not appear to be technically sophisticated in the area of computer intrusions. Keys interest appears to be soley in the 
realm social media usage on the Internet. His involvement with Anonymous is likely only a journalistic interest. 

Keys, according to his webpage, has left the Sacramento area and now works for KGO Television in San 
Francisco. His residence is unknown. Keys will not answer his phone, nor return phone calls or emails sent by the writer. 

Based on the lack of venue in the Eastern District, it is recommended this case be transferred to Los 
Angeles. The above information, as well as other case data, can be packaged in the form of a Letterhead Memorandum 
(LHM) and sent to London by Los Angeles. 



LEAD(s): 

Set Lead 1: (Action) 

LOS ANGELES 
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To: Los Angeles From: Sacramento 

Re: 288A-SC-44639 



At LOS ANGELES, CA 

Receive results of investigative efforts in Sacramento and pursue logical investigation. 

Set Lead 2: (Action) 

SACRAMENTO 

AT SACRAMENTO, CA 

CY-1 SST to mail main case file, to include 1A, to Los Angeles, CY-3 attention SSA Jason Smolanoff, telephone 
310-996-3805. 

Set Lead 3: (Action) 

SACRAMENTO 

AT SACRAMENTO, CA 

ELSUR to mail 288A-SC-44639 evidence item 1D1 to Los Angeles, ELSURfor further attention of SSA Jason 
Smolanoff, telephone 310-996-3805. 
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